Severe Session issues ASP.NET

Question

I have a kind of an ugly situation.

I have a big program that uses session to carry over data from one page to another in a CRM system build in ASP.NET 3.5 C#

The problem is that if you have two instance of this program open in the same browser and browse the same page, the sessions of course gets overridden.

As you can imagine, this is a huge issue and a huge liability for the system.

What is the right thing to do here? I use tons of AJAX, and need to pass objects from page to page, so url parameters is not really an option here.

Any suggestions?

Answer 1

What is your web.config sessionState configured? I think in your situation you can reduce the severity of your problem by configuring it as follows:

<configuration>
   <system.web>
      <sessionState mode="InProc" cookieless="true" timeout="20"/>
      OR
      <sessionState cookieless="true" regenerateExpiredSessionId="true" timeout="20" />
   </system.web>
</configuration>

But the latter is going to mangle your URLs. You'll end up with ASP.NET inserting session IDs into your URLs, something like http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx. More about it here.